On Fri, Jun 08, 2007 at 05:03:55PM +0200, Stefan Schimanski wrote: > Critical bugs don't get less critical by ignorance. > > If anybody wants to know more: > > 1) CommandInset (used e.g. for references in mathed) has two cells to > hold information about where it points to. But it only draws a > button, not the cells themselves. So accessing the cells' coordinates > in the cache during drawSelection segfaults. > 2) This all happens only because, after creating the InsetMathRef > (derived from CommandInset) with \ref, the cursor is inside of it. > Hence, InsetMathNest will try to draw the selection inside the > InsetMathRef below the cells. > 3) So, why is the cursor inside it? Because it is derived from > InsetMathNest and has >= 1 cells. The LFUN_SELF_INSERT handler of the > hull (in fact in InsetMathNest::doDispatch) takes this as a reason to > put the cursor inside. I guess that's not correct, because the cursor- > left behavior normally checks the isActive() method before entering > an inset. But here isActive() is not called.
Good analysis. > So I propose the following patch (which fixes #3715). The first hunk > is trivial. But I am not sure about the consequences of the second. I > think it's the correct way to insert an inset, but maybe there are > other inset which depend on the old (wrong) behavior. Comments? I can't tell you. It is conceptionally sound, however, so close to 1.5.0 it might be more prudent to use something like ... && !atom->isMathRefInset() and put a fat FIXME there to ask fopr investigation in quieter times. The second part most definitely has a potential smell of brown paperbags... Andre'
